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I. INTRODUCTION 

The security of quantum cryptography P, 0)0 is based 
on two main ingredients. The first refers to the im- 
possibility of perfectly cloning some unknown quantum 
state selected from a nonorthogonal set 0. As a re- 
sult, the potential eavesdropper Eve cannot clone the 
quantum state transmitted by Alice and re-transmit it 
undisturbed to the receiver Bob. The second ingredi- 
ent, although often mentioned only implicitly in the lit- 
terature, is also an absolute requirement: truly random 
numbers must be available on both Alice's and Bob's 
sides. Indeed, with pseudo-random number generators, 
the sequence of choices made by Alice and Bob could 
in principle be predicted by Eve if the seed is known to 
her. Clearly, quantum cryptography should use quantum 
randomness. But, in practice, this is a severe constraint 
because a complete protocol requires a huge amount of 
random numbers, from Alice's state choices to Bob's ba- 
sis choices, as well as for the random choices and random 
permutations needed in error correction and privacy am- 
plification. Making high-speed quantum random-number 
generators is a big technological challenge, so that most 
realizations of quantum cryptography today rely on an 
active [Tsj choice that uses a standard random-number 
generator. It is therefore of a great importance to in- 
vestigate whether this requirement of high-rate random 
number generation can be relaxed, at least in part. 

In this paperjWe consider a variant of the BB84 l] 
or six-state 0, Q protocols in which the basis chosen 
for encoding is kept unchanged over long sequences of 
qubits instead of being drawn at random for each qubit. 
We show that, quite surprisingly, the security is unaf- 
fected by this modification of the protocol although the 
random number generation rate is significantly reduced. 
The BB84 and six-state protocols are amongst the cryp- 
tographic schemes for which the security has exhaustively 
been studied. In various cases the optimal eavesdrop- 
ping strategy has been found explicitly H, IE 1 and was 



shown to coincide with approximate cloning |8j . For this 
reason, we restrict our analysis to cloning-based attacks 
in the following. 

We consider the cloning of sequences of qubits. In 
each sequence the qubits are prepared in the same basis, 
but the state is chosen at random among the basis states 
[l6j |. This is viewed as the optimal eavesdropping attack 
against a quantum cryptographic protocol in which we 
do not restrict Alice and Bob to make random choices 
of bases for every qubit, but allow them to use the same 
basis for the entire length- A^ sequence {N is assumed to 
be publicly known). That is, for each sequence, Alice 
and Bob make new and independent random choices of 
bases. At first sight, one could imagine that this encod- 
ing would increase Eve's knowledge about the secret key, 
but we shall see that for the class of cloning transforma- 
tions we have studied, this is not the case: Eve's optimal 
cloning attack provides her with no more Shannon in- 
formation, for a given quantum bit error rate, than in 
the usual case where Alice and Bob make random basis- 
choices for each qubit and Eve applies a cloning attack 
on each qubit. Under the assumption that this class of 
approximate cloning transformations corresponds to the 
optimal eavesdropping strategy, we have thus proven that 
the requirement for random number generation can be 
reduced without impairing on the security against finite- 
size attacks 9l. 



The paper is organized as follows. In Section II, we de- 
scribe a general formalism for quantum cloning [wL [ll| , 
and adapt it to the case of interest here. In Sections III 
and IV, we apply this formalism to 2-qubit cloning at- 
tacks in the BB84 and six-state protocols, respectively, 
and show that using the same bases does not affect the 
cloning fidelity. Section V contains a generalization of 
these results in dimensions being any power of two. Fi- 
nally, in Section VI, we summarize our results. 
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II. GENERAL QUANTUM CLONING 
FORMALISM 

We refer to a general class of cloning transformations 
as defined in Refs. [1(1. Considering an arbitrary 

state IV') in a 2^-dimensional Hilbert space, we wish to 
produce two (approximate) clones. The class of cloning 
transformations we will analyze is built following the 
"Cerf ansatz": if the input state is then the resulting 
joint state of the two output clones (noted E and B) and 
the cloning machine (noted C) is: 

2"-l 

IV") X! °'rn,nUm,n\'^)E\Brn,n)B,C 

7n,n—0 
2"-l 

= ^ bjnMUm./n\i')B\BmM)E,C (1) 
rn.n—0 

where the couple {m, rT} {mi . . . m^v, ni . . . njv} and 
iTLi,ni S {0,1}. Here, E, B and C are 2^-dimensional 
systems and Urn,n is defined as 

N 

«7™,Tr = (g)^'"'2"-. (2) 

1=1 

where X™' Z"' represents the identity and the three Pauli 
matrices 





= I 




= CTx 








= — icr, 



Here, \Brn,n) is defined as 

|B™,w) = 5] (-l)('^-")|I)|fc + m) (3) 

fe=0 

where fc • n represents the bitwise scalar product, i.e. 
k -n = '^^kiJii. Thus, C/m_7T is the tensor product of 
A'^ Pauli matrices each acting on a two-dimensional sub- 
system. An error operator Umi,ni is associated to each 
subsystem. Such an operator shifts the state by rrii 
units (modulo 2) in the computational basis, and mul- 
tiplies it by a phase so as to shift its Fourier transform 
by Ui units (modulo 2). Eq. Q defines the <P general- 
ized Bell states for a pair of 2^-dimensional systems with 

\Bm,n) — Ujn^n (E) I l-^g^o)' 

Tracing over systems B and C (or E and C) yields the 
final states of clone E (or clone B): if the input state is 
\ip), the clones E and B are in a mixture of the states 



\'tpm,n} = Urn.nl'^) "^'^^^ respective weights pm,^ and qfn,n- 

PB = ^ Prn.n\i^.n){'^Prn,n\ 
rn.n—Q 

2"-l 

PB = ^ qrn,n\'^.n){lhn.n\ (4) 
rn.n—O 

In addition, the weight functions of the two clones {pm,n 
and qm.n) are related by 

Prn.n — |^m,n| i Qrn,n — |^^m,n| : (5) 

where ajn.ji and bm,n are two (complex) amplitude func- 
tions that are dual under N two-dimensional Fourier 
transforms: 

2"-l 

f^-^=^T. (-1)^"^«^,17- (6) 

'x^'y—O 

The fidelity of a clone, say E, is given by 

2"-l 
rn.n—O 

and similarly for the B clone (replace the lam^^rp term 

by \brn,n\^)- 

III. BB84 PROTOCOL WITH 2-QUBIT 
CORRELATED BASES 

In this section we compare the amount of information 
that can be gained by Eve when performing a cloning at- 
tack on individual qubits (two-dimensional) and on pairs 
of qubits (four-dimensional) which may have been chosen 
from correlated bases. We study here how this affects the 
BB84 protocol and in the next section we move on to the 
six-state protocol. 

In the BB84 protocol, Alice chooses from states be- 
longing to two mutually unbiased bases. Two bases A 
and B for a d-dimensional system are said to be MU ^3 
if a state prepared in any element of A (such as |A, a)) 
has a uniform probability distribution of being found in 
any element of B, namely 

\{A,a\B,(3)\ = ^. (8) 

Conventionally, Alice and Bob choose the first basis 
as the so-called computational basis (eigenstates of CTz) 
{|0), |1)} and the second as the dual basis (eigenstates of 
a.) {-i=(|0)±|l))}. 

A. BB84 - single qubit attack - no basis correlation 

If Eve chooses to clone the qubits individually, she 
must use a cloning strategy which is optimal for this set 
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of states. When using the cloning formahsm described 
in Sec. I, one can easily verify that the expression of the 
fidelity for all states of a given basis is the same. The 
reader familiar with this calculation can easily skip to 
the next subsection without any loss of generality. Here 
and throughout the paper, we consider fidelities as ex- 
pressed by Eq. Q. Particularly for Eve's clone one 
finds that the fidelity for the computational basis is Fe — 
|ao,oP + |ao,iP ^^'^ the dual basis is Fe = |ao,oP + |ai,oP- 
A cloning machine that acts equally well for this set of 
states implies |ao,oP + |ao,iP — ho,oP + ki,o|^- Since 
there is a priori no reason why the optimal values of 
these elements be different from each other, we make the 
hypothesis that they should all be equal and real. Fur- 
thermore, we extend our hypothesis to the remaining ele- 
ment, |ai_ip such that the form of the amplitude matrix 
reduces to: 



V X 

X y 



(9) 



Eve's fidelity is now expressed as Fe — v'^ + x^ and nor- 
malization requires + 2x'^ + y'^ = 1. Bob's clone can be 
characterized by a similar amplitude matrix by making 
the same hypotheses: 



x' y' 



(10) 



where the different matrix elements are related to the 
flm.n coefficients by Eq. Thus, Bob's fidelity is 

Fb = w'^ + x'"^ in both bases and the corresponding mu- 
tual information between Alice and Bob (if the latter 
measures his clone in the good basis) is given by 

Iab = 1 + Fb log2 Fb + {1~ Fb) log2(l - Fb). (11) 

Maximizing Eve's fidelity Fe for a given value of Bob's 
fidelity Fb under the normalization constraint yields 

1 



V - ^ + ^JFb{1-Fb) 



X = Fb- 



V - i^-^FBil-FB) 
such that the corresponding optimal fidelity for Eve is 

Fe = ^ + + ^/Fb{1~Fb). (12) 

Csiszar and Korner's theorem 'l3f| provides a lower bound 
on the rate R at which Alice and Bob can generate secret 
key bits using privacy amplification: 



R > max(/^B - Iae,Iab - Ibe) 



(13) 



where Iae and Ibe represent the mutual information 
between Alice and Eve, and Bob and Eve respectively. 
It is therefore a sufficient condition that Iab > Iae in 



order to establish a secret key with non-zero rate for one 
way communication channels. It has been shown in 
that Bob and Eve's information curves intersect exactly 
where the fidelities coincide because, in this particular 
case, the mutual information shared between Alice and 
Eve is also expressed by Eq. (|11|) . This yields the optimal 
symmetric fidelity of phase covariant cloning Il4| 



Fe=Fb = 1 + ^~ 0.8536. 
2 ^/8 



(14) 



Note that this result is independent of the fact that Al- 
ice may have chosen to encode sequences of consecutive 
qubits in the same basis since Eve is intercepting them 
individually. 



B. BB84 - two qubit attack - no correlation 

Suppose now that Eve intercepts the qubits in se- 
quences of two and clones them. We make the same 
assumption as before, namely that Alice has randomly 
chosen the basis she has encoded her qubit with. We 
would like to know if Eve can gain more information per 
qubit using this cloning approach as opposed to cloning 
them individually. Our first task is to determine the set of 
states that she will have to clone. If Alice chooses among 
the computational and dual bases, the possible sequences 
Eve might encounter are products of eigenstates of trf ^ : 
|00), |01), |10), 111), products of eigenstates of af^: 

i(|00) + |01) + |10) + |ll)), 

i(|00)-|01) + |10)-|ll)), 

i(|00) + |01)-|10)-|ll)), 

i(|00)-|01)-|10) + |ll)), 

and products between eigenstates of these two bases (az'S) 
ax and (Jx (8) ctz ) : 

-i=(|00)±|01)) , i=(|10)±|ll)) 

-^(|00)±|10)) , i=(|01)±|ll)). 

Because we are now dealing with a /our-dimensional 
Hilbert space {N = 2) with tensor product structure, 
the Ujnji operators take the following form: 



U, 



mim2;nin2 



/ z 

X Y 



I z 

X Y 



Each of these matrix elements consists in a tensor prod- 
uct of two Pauli operators each acting on an associated 
qubit. Eve is interested in the information she can gain 
from a single qubit when she clones them in sequences 
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of two. In other words, Eve is interested in the opti- 
mal /owr-dimensional cloning map where the figure of 
merit is not the single-clone /owr-dimensional fidelity 
but rather the single-clone, single-qubit tw;o-dimensional 
fidelity averaged over the two qubits. To obtain this fi- 
delity, we must trace over the second qubit subsystem 
and compute the fidelity of the first qubit, repeat this 
operation for the second qubit by tracing out the first 
qubit subsystem and finally average over the two fideli- 
ties. For example, the reduced density matrix of the first 
qubit for Eve's clone is expressed as: 

Pe = Tr2[ ^|a^,w|2X™^Z"H0i)(</'i|^"^^'"^ 



where \(j}i) is a two-dimensional system. For sequences of 
qubits both drawn from eigenstates of the fidelity is 



2™-l 

Fh,.. = E \arn,M(t>i\X^'Z"^\(t>i)\' 

■m=0,n=0 
2"-l 



— ^ ^ |^m,n| *^mi,0 
m=0,n=0 

for the first qubit and 

2^-1 
m=0,n— 

~ ^ ^ I'^mjTil ^m2,0 
Tn=0,n=0 



(15) 



(16) 



for the second qubit. For clusters of qubits both drawn 
from eigenstates of ax the fidelity is 



Every single-qubit fidelity consists in a sum of eight terms 
for which the first four express the fidelity of the four- 
dimensional system in question (in other words the con- 
tribution from the am,n coefRcients where no errors occur 
on either qubits) while the remaining four terms corre- 
spond to the arn,n coefRcients for which the qubit is 
not affected by an error but the remaining one is. Gen- 
erally, the fidelity of the i^^ qubit is expressed as 



F4E + Dl 



(19) 



where F^e is the fidelity of the /our-dimensional sys- 
tem and is the disturbance of the i^^ qubit and is 
expressed as 



E 



^^m.-.l <5m^i,0 (20) 



m— O.n— 



for qubits drawn from the computational basis and 

\<lm,n\'^Sni,l dn^i,0 (21) 



D 



2"-l 

.=_E 

m=0,n=0 



for qubits drawn from the dual basis. Here, the qubit of 
the pair which is not the qubit is given the index ->i. 
The average qubit fidelity of Eve's clone is therefore: 



FE = FiE + ^{Dl, + Dl). 



(22) 



A similar analysis can be made for Bob's clone from 
which we obtain a single-qubit fidelity 



FB=FiB + l{Di+D%) 



(23) 



which is function of the bfn,n coefficients. We are again 
interested in the mutual information shared between Al- 
ice and Bob and Alice and Eve. To do this, let us first 
compute Eve's optimal fidelity Fe for a fixed value of 
Bob's fidelity Fb under the normalization constraint 



Fe,xx — \<lm,n\^Sni,i 
m=0,n=0 



(17) 



for the first qubit and 



2™-l 



Fe,xx — E \c-m,nfSn2,0 

m— O.n— 



(18) 



for the second qubit. To be complete, we must also com- 
pute the fidelity for clusters expressed as tensor prod- 
ucts drawn from eigenstates of Uz (8" ctx and ctx ® ^z- 
The former yields = F^ for the first qubit 

and F| = F| for the second qubit. The latter 

yields a fidelity of F^ = F^ for the first qubit and 
Fe xz ^ F'^ 2z ^'^^ the second qubit. The expressions for 
these fidelities F^ can easily be interpreted as follows. 



E l«m>nl^ = 1 
m= 0,71=0 



(24) 



and the constraint that the single-qubit fidelity be the 
same for all 16 considered input states. The optimization 
yields the following am,n matrix: 









X2 \ 




yi J 


V X2 


2/2 / 



where 



Vi 

yi 



= V2 = ^ + ^yFB{l-FB) 

= X2 = Fb-1: 



2/2=2" VFb{1-Fb) 



(25) 
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such that 



Fb , 1 — Fb 



+ ^Fb{1-Fb). 



(26) 



From the previous subsection we know that Bob and 
Eve's information curves intersect exactly where the fi- 
dehties coincide. This imphes that Ahce and Bob can 
share secret bits via privacy amphfication as long as 
Fb > Fe, that is 

This optimal symmetric fidelity turns out to be the same 
as the optimal fidelity obtained when the doner is de- 
signed for iuio-dimensional systems meaning that the 
optimal /our-dimensional cloning map for single-qubit 
single-clone fidelity boils down to the tensor product of 
the iiuo-dimensional optimal doners. 



We conclude that even if Alice chooses to encode two con- 
secutive states in the same basis, Eve's optimal cloning 
strategy does not permit her to gain more information 
than complete random choices. In Section V we will gen- 
eralize this idea for sequences of N qubits, but first let 
us examine how these cloning strategies apply to the six- 
state protocol. 



IV. SIX-STATE PROTOCOL WITH 2-QUBIT 
CORRELATED BASES 



The six-state protocol is very similar to the BB84 pro- 
tocol, the only difference being that Alice now has the 
choice to pick up states from a third basis MU to the 
other two. Again, let us choose the first two bases as the 
computational basis and the dual basis and let the third 
basis be the eigenstates of ay-. {^{\0) ± 



C. BB84 - two qubit attack - correlated bases 

Now consider the situation where Alice is limited by 
her random number generator and must therefore send 
two consecutive states drawn from the same basis in or- 
der to keep a decent cadence . Of course if Eve inter- 
cepts every qubit individually, the fidelity she obtains af- 
ter cloning is just the same as before, namely F — 5 + -^- 
If she intercepts them in sequences of two qubits she will 
necessarily find that they are correlated: either she ex- 
pects to find two qubits drawn from the computational 
basis az (equivalently, a four dimensional state drawn 
from the eigenstates of cr^ (gjtr^) or two qubits drawn from 
the dual basis ax (equivalently, a four dimensional state 
drawn from the eigenstates of cr^ (g) ax)- Compared to 
the previous situation where no correlation was present, 
the set of input states Eve has to consider has now de- 
creased. Intuitively we should expect that the optimal 
single-qubit doner would give rise to a higher fidelity. 
We shall see that this is not the case. 

The doner we consider is again characterized by the 
"Cerf ansatz" ^ such that the single-qubit fidelity for 
this set of input states is defined exactly like Eqs. H15|) 
and Hl()|) for eigenstates of a^ and like Eqs. (|17|l and 
(|18|l for eigenstates of ax ■ These are the four expressions 
of the fidelity for which the ajn^n (and consequently the 
bm,n) coefficients must be optimized for. The constraints 
we must consider here are the normalization constraint 
and the constraint that these four expressions be equal. 
Of course, these fidelities are again characterized by Eq. 
(I22|l . Interestingly, the constrained optimization yields 
cim.n coefficients which have exactly the same form as 
Eq. H25I) and therefore the same expressions for Eve's 
fidelity as a function of Bob's. Once again, the lower 
bound on the mutual information Alice and Bob must 
share in order to generate a secret key is given by 



F > 



1 



1 



A. six-state - single qubit attack - no correlation 

The doner that must be used for the six-state proto- 
col is an asymmetric two-dimensional universal doner Q 
characterized by the same amplitude matrix as Eq. @ 
except that we make the change y — x: 



V X 
X X 



Eve's fidelity is expressed as Fe = 



and normal- 



ization requires w'^ -\-2tx^ = 1. Maximizing her fidelity for 
a fixed value of Bob's fidelity yields the optimal doner: 



1-Fb 



Bob's clone is characterized by a similar amplitude ma- 
trix: 



i^,n ~ \ x' x' ' ^ 



(27) 



where as before, v' and x' are given by Eq. ® while the 
mutual information he shares with Alice by Eq. It 
has been shown in that the mutual information shared 
between Alice and Eve for the six-state protocol is given 
by 



Iai 



1 + {Fb + Fe- 
(l-FB)log2(- 



I)l0g2(- 

-Fe, 



Fb 



-) 



(28) 



such that for a given Fb , Iae is lower than for the BB84 
protocol which is consistent with the stronger require- 
ment we put on that doner. This implies that the fidelity 
Fb for which I^^e — Iab is slightly lower, and equal to 
Fb ~ 0, 8436. 
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B. six-state - two qubit attack - no basis correlation such that 



If Eve chooses to clone the incoming states in sequences 
of two, the set of four-dimensional states she has to 
clone consists of tensor products of states belonging to 
the three maximally unbiased bases above. The single- 
qubit fidelity is computed as above, with the exception 
that there are extra constraints, namely that the fidelity 
should also clone equally well eigenstates of ay-. 



pi — 

^E,yy - 



E 



m— O.n— 



for the first qubit and 



2™~1 



E,yy 



for the second qubit. The other constraints come from 
tensor products of ay(>^az, Uy^cTx and vice- versa. The ex- 
pression for the fidelity of the qubit can be expressed 
as: 



F|; — FiE + F)^E 

where, for eigenstates of ctj,. 



777 — 0,71 — 



The average qubit fidelity is again: 



Fe=F. 



4E 



Dl). 



(29) 



(30) 



(31) 



As before a similar analysis can be made for Bob's clone 
from which we obtain a single-qubit fidelity 



1 



Fb ^ F^B + T:iD]3 + Dl). 



(32) 



We are again interested in the mutual information shared 
between Alice and Bob, and Alice and Eve. We compute 
Eve's optimal fidelity Fe for a fixed value of Bob's fidelity 
Fb under the normalization constraint Ea. H24l) and the 
constraint that the single-qubit fidelity be the same for 
all input states. The optimization yields the following 
Om 77 matrix: 









X2 \ 


V 2^1 


Xl J 


V X2 


X2 ) 



(33) 



where 



Vi = V2 



3Fb-1 



1-Fb 



Fb , 1 



Fe = 1-^ + -^/6Fb-2^2-2Fb. 



(34) 



In the previous subsection, we have seen how to express 
Iab and Iae- Again in this case the lower bound on 
Bob's fidelity needed for Iab > Iae is given by Fb > 
0.8436 which is the same fidelity for individual attacks. 
Thus, so far, we arrive to the same conclusions as for the 
BB84 protocol. 



C. six-state - two qubit attack - correlated bases 

If Alice is again limited by her random number gener- 
ator and must encode two consecutive qubits in the same 
basis. Eve can clone the incoming states by sequences of 
two expecting to find four-dimensional states expressed 
as eigenstates of ct^ (g) CTz , <Jx or Oy^Oy. By making a 
similar reasoning as in the previous subsection we arrive 
to the same conclusions as before, namely that the infor- 
mation Eve can gain when cloning a /our-dimensional 
system boils down to the optimal single qubit informa- 
tion. 



V. CLONING OF iV-QUBIT SEQUENCES 

We now proceed to generalize the cloning strategies 
considered in the previous sections. We suppose that Al- 
ice encodes her qubits using the same basis for sequences 
of N qubits. We also suppose that N is much smaller 
than the total size of the raw key she will be exchanging 
with Bob. We also suppose that Eve is aware of when a 
new sequence begins and ends. 

Generally, for a sequence of N qubits, the reduced den- 
sity matrix of the qubit for a given clone (say E) is 
written as 



Pe 



N 



= 5]|a7T7,77pX"'^"'|07)(07|^"'^'"% (35) 

such that fideHty of the j qubit is written as 

F'e = Fe2« + D% (36) 

and similarly for qubits of Bob's clone. The average qubit 
fidelity is therefore expressed as: 



F, 



B2" 



1 ^ 

-Ydi 



(37) 



7 = 1 



If we assume that the optimal ajn^n amplitude matrices 
are expressed as 



V X 

X y 



(38) 
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for the BB84 protocol and 

for the six-state protocol, we can check that they indeed 
satisfy a constrained optimization. Since the informa- 

I 



where the modular sum is in base 2. The equivalent 
expression of Eq. H4Q(I for the six-state protocol is very 
similar except that one should exchange for x^. 

We have checked, using a symbolic calculator, that the 
hypothesized amplitude matrices satisfy the constrained 
optimization and yield the optimal fidelities (Eqs. H26|l 
and ^) for iV = 2 and = 3. 

VI. CONCLUSION 

We have considered the cloning of sequences of N 
qubits, where all the qubits in each sequence are prepared 
in the same basis while each state is chosen at random. 
This situation is very different from the usual scenario of 
cloning multiple copies, where all the copies are prepared 
in the same state. Our investigation was motivated by 
the situation in quantum cryptography where the legiti- 
mate users are required to make truly random choices for 
each single qubit. From a practical point of view, this re- 
quirement on high-speed random-number generation is a 
severe constraint. 

However, under the assumption that the class of 



tion curves are both monotonically increasing functions 
of the fidelities, we use the Lagrange multiplier method 
to optimize Eve's fidelity for a fixed value of Bob's. 

The constraint that the fidelity for different qubits in 
the sequence be the same is already satisfied by the hy- 
pothesized am.n matrix. The function is: 



(40) 

I 

cloning transformations we considered here provides the 
optimal eavesdropping strategy, we have shown that this 
requirement can be relaxed, so that Alice can prepare 
long sequences of qubits in the same basis without com- 
promising the security. Surprisingly, Eve cannot exploit 
her knowledge that the used basis is fixed for the entire 
sequence, regardless of its length (provided it is much 
shorter that the total key size). This result is quite im- 
portant for practical applications of quantum cryptog- 
raphy as it implies that higher secret-key rates may be 
obtained using the same random number generator but 
with this new modified protocol. 
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C = Fe+XiFb+\2{ lOm.rrp-l) 
m,n— 

AT TV TV 

m— i—1 2—1 

N N N 

+ ^1 []v E " E "^^) n( 2 + + ^y)"'®'(2 - «^ - ^yr-] 

77T— i—1 i—1 

+ \2[[v^ + 2x^+y^)'' -I] 
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